Scovai is designed with data protection at its core. This GDPR Policy outlines how we comply with the General Data Protection Regulation (EU) 2016/679 and describes the safeguards we implement to protect the rights of data subjects, particularly candidates whose personal data is processed through our AI-powered recruitment platform.
1. Our Role Under the GDPR
Scovai operates in two capacities depending on the context:
- Data Processor: When organisations (Tenants) use Scovai to manage their recruitment and people management processes, we act as a data processor on behalf of the Tenant (the data controller). Processing is governed by the GDPR Article 28 data-processing commitments set out in our Data Processing Agreement and our Companies Terms of Service.
- Data Controller: For our own website visitors, direct applicants to our talent pool, and account holders, we act as the data controller.
2. Data Protection by Design and Default
In accordance with GDPR Article 25, Scovai implements data protection by design and by default:
- Multi-tenant isolation: Each organisation's data is logically isolated. Users can only access data within their own tenant.
- Minimal data collection: We only collect data that is necessary for the recruitment functionality being used.
- Pseudonymisation: Vector embeddings used for semantic matching are not human-readable and cannot be reversed to reconstruct the original CV text.
- Access control: Role-based access control (RBAC) ensures that users only see data relevant to their role (Admin, Recruiter, or Candidate).
- Encryption: All data in transit is encrypted via TLS 1.2 or 1.3. Sensitive credentials are encrypted at rest with AES-256 — GCM for Digital Employee credentials, CBC for AI provider keys, connected-inbox tokens and contract-signing tokens. The database and uploaded files are not separately encrypted at rest.
3. Consent Management
Scovai provides a built-in consent management system that:
- Records granular consent for specific processing purposes (CV parsing, AI scoring, psychometric assessment, interview participation, talent pool inclusion)
- Maintains a full audit trail of when consent was given, modified, or withdrawn
- Allows candidates to withdraw consent at any time through their profile
- Automatically restricts processing when consent is withdrawn
4. Automated Decision-Making Safeguards (Article 22)
Scovai uses AI for scoring, profiling, and assessment. We implement the following safeguards under Article 22(3):
4.1 No Solely Automated Decisions
The Platform is designed as a decision-support tool. AI outputs (scores, rankings, interview evaluations) are presented as recommendations to human recruiters, who retain full authority over hiring decisions.
4.2 Explainability
Every AI-generated score includes an Explainable AI (XAI) rationale that describes, in plain language, the factors that influenced the score. This includes:
- Which skills and qualifications contributed to the score
- What adjustments were applied and why
- How the candidate compares to position requirements
4.3 Right to Contest
Candidates can request human review of any AI-generated assessment or score through the Platform's compliance module. Tenants are notified and must respond to review requests within a reasonable timeframe.
4.4 Bias Monitoring
The Platform includes automatic bias monitoring that analyses AI scoring patterns for demographic disparities, including gender and age distribution across scores.
5. Data Subject Rights
Scovai supports the exercise of all GDPR data subject rights:
| Right | GDPR Article | How Scovai Supports It |
|---|---|---|
| Access | Art. 15 | Candidates can view all their data through their profile. Tenants can export candidate data via the compliance module. |
| Rectification | Art. 16 | Candidates can edit their profile data directly. Recruiters can update candidate information. |
| Erasure | Art. 17 | GDPR data export and deletion requests can be initiated through the compliance module with full audit logging. |
| Restriction | Art. 18 | Processing can be restricted on a per-candidate basis while disputes are resolved. |
| Portability | Art. 20 | Data can be exported in structured JSON format via the compliance module or API. |
| Objection | Art. 21 | Candidates can object to profiling and automated processing through their consent settings. |
| Automated decisions | Art. 22 | Human review requests can be submitted for any AI decision. See Section 4 above. |
6. Data Processing Commitments (GDPR Art. 28)
Every Tenant relationship is governed by GDPR Article 28 data-processing commitments, set out in our Data Processing Agreement and our Companies Terms of Service, that specify:
- The subject matter and duration of processing
- The nature and purpose of processing
- The types of personal data processed
- The categories of data subjects
- The obligations and rights of the controller and processor
- Sub-processor requirements and approval procedures
7. Data Breach Procedures
In the event of a personal data breach, Scovai will:
- Notify affected Tenants (data controllers) without undue delay and within 72 hours of becoming aware of the breach
- Provide detailed information about the breach, including the nature of the data affected, the likely consequences, and the measures taken to address it
- Assist Tenants in fulfilling their own notification obligations to supervisory authorities and data subjects
- Document all breaches in an internal breach register
8. Sub-Processors
Scovai minimises the use of sub-processors. Currently:
- AI processing: AI tasks of the platform (CV parsing, scoring, assessments, interviews) are processed by named sub-processors, Anthropic and OpenAI, under data-processing agreements, routed through a centrally configured, audited gateway. Candidate data is stored within the EEA, and API data is not used to train provider models. A Digital Employee in the European region uses those same providers; a Digital Employee in the Middle East region does not use that gateway, and its model provider is described below.
- Voice and embeddings: Speech-to-text, text-to-speech and text embeddings use the OpenAI API, routed through a centrally configured and audited gateway, under equivalent data-processing terms.
- Infrastructure: Application hosting and data storage for the platform are located within the European Economic Area, on servers provided by Contabo GmbH in France; AI sub-processors may process data outside the EEA, and those transfers are to be covered by Standard Contractual Clauses, whose execution Scovai is completing with each provider (see the Data Processing Agreement). A Digital Employee runs in the processing region its customer chooses, described below: within the European Economic Area in the European region, outside it in the Middle East region.
The audited gateway (OpenRouter) may route specific auxiliary AI tasks to additional vetted model providers under the same no-training and data-processing-agreement constraints.
Accounts that a person links to a Digital Employee (Gmail, Google Calendar, Outlook, Microsoft 365, WhatsApp, Telegram, Instagram and LinkedIn) may be connected through UNIPILE, a connection broker, under a data-processing agreement.
We will notify Tenants before engaging new sub-processors that handle personal data.
Digital Employees. A Digital Employee runs in a virtual machine in the processing region its customer chooses; Scovai offers two. In the European region, the virtual machine runs on servers provided by Contabo GmbH in France, within the European Economic Area, and the language model is Anthropic, OpenAI or a provider routed through OpenRouter, under data-processing agreements with no-training terms: the same providers that serve the platform's own AI features. In the Middle East region, the virtual machine runs on servers owned and operated by OmniSage LLC in the data centre at 2704 Fortune Executive Tower, Cluster T, Jumeirah Lakes Towers (JLT), Dubai, United Arab Emirates, outside the European Economic Area, and the language model is Zhipu AI (GLM), called directly at an endpoint in the People's Republic of China, with Sakana AI in Japan as the fallback. In either region the virtual machine holds the Digital Employee's working memory, transcripts, shared files and mailbox, and the material it is working on at that moment is sent to its language model as context for the reply. Digital Employees hired before the European region opened run in the Middle East region; a customer who prefers the European region for them can ask at privacy@scovai.com. Apps a person connects to a Digital Employee, such as Google Drive, Docs, Sheets and Meet, are authorised and carried out through Pipedream, Inc. in the United States, in either region. The platform itself, its database and uploaded files are hosted by Contabo GmbH in France; the scovai.com website is delivered through Cloudflare; transactional email leaves through the GPlugin mail relay. Transfers outside the EEA are addressed in the Data Processing Agreement.
9. Data Retention and Deletion
Data retention periods are set at the platform level. Default retention periods are detailed in our Privacy Policy. Interview recordings are deleted automatically 90 days after the interview, and live meeting recordings 180 days after the meeting, by a daily job. Transcripts, summaries and action items are not deleted on a timer: they are kept until the Tenant deletes the interview or the meeting, or the workspace is deleted. The two recording periods are set by Scovai and are not currently configurable per Tenant. An application, and the assessments, interviews, scores and integrity records derived from it, are deleted by a nightly job 12 months after the application was decided, and talent-pool entries 24 months after their last activity. Deletion of other records is carried out through our data governance process, including on request via the compliance module or a data subject erasure request.
10. Contact the Data Protection Team
For GDPR-related enquiries, data subject requests, or questions about our data-processing commitments:
Email: privacy@scovai.com
